VCAP-DCA Objective 6.1 Configure, Manage and Analyze vSphere Log Files
July 25, 2010 
Sean Crookston 
This is the first pass at studying Objective 6.1, Configure, Manage and Analyze vSphere Log Files. I have hit most of the areas outlined in this section of the objective and this section as the others will be a work in progress over time.
Knowledge
· Identify vCenter Server log file names and locations
o http://www.vmwarewolf.com/which-virtual-center-log-file/
· Identify ESX/ESXi log files names and locations
· Identify tools used to view vSphere log files
Skills and Abilities
· Generate vCenter Server and ESX/ESXi log bundles
o vCenter Server
§ http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1011641
· Use vicfg-syslog to configure centralized logging on ESX/ESXi Host
o From the command line
vicfg-syslog <conn_options> -i
Displays the syslog server configuration.
vicfg-syslog <conn_options> -s mysyslogserver
Makes mysyslogserver the syslog server for the server specified in <conn_options>.
vicfg-syslog <conn_options> -p <port>
Sets the port number used by the syslog server.
o From the GUI
· Test centralized logging configuration
See below.
· Configure the vMA appliance as a log host
o It is still unclear to me at this time if the test will be on 4.1, or rather how soon it will be so it is important to study the new features with AD integration. Research the command for domain joining of the vMA, domainjoin-cli
o Great blog on setting up for AD authentication and connecting http://geeksilver.wordpress.com/2010/07/22/how-to-use-vma-4-1-installation-configuration/
o Great blog on setting up your vMA appliance as a log host http://www.simonlong.co.uk/blog/2010/05/28/using-vma-as-your-esxi-syslog-server/
· Use vilogger to enable/disable log collection on the vMA appliance
· Use vilogger to configure log rotation and retention
To add a server:
Sudo vifp addserver <FQDN ESX host>
To enable logging:
Vilogger enable –server fqdn servername –numrotation xx –maxfilesize xx –collectionperiod xx
To disable logging:
Vilogger disable –server fqdn servername
To list the servers added :
Vifp listservers
To specify the current target for commands entered in the vMA:
Vifptarget –s systemname
· Analyze log entries to obtain configuration information
· Analyze log entries to identify and resolve issues
o Very good blog entry on logs here http://www.simonlong.co.uk/blog/2010/06/03/vmware-esxi-4-log-files/
o ESX logs
under /var/log
vmkernel- VMKernel Messages
vmkwarning- VMKernel Warnings
messages- Service Console Log
Under /var/log/vmware
hostd- ESX Service Log
aam- HA Log
Under /var/log/vpx
vpxa- vCenter Agent log
ESXi logs under /var/log
hostd- ESXi Service log
messages- Syslog(vmkernel/hostd)
vxpa- vCenter Agent Log
Tools
· vSphere Management Assistant Guide
o Download from http://www.vmware.com/support/developer/vima/vma41/doc/vma_41_guide.pdf
o The vSphere Management Assistant (vMA) is a CentOS-based virtual machine that includes prepackagedsoftware such as the vSphere command-line interface, and the vSphere SDK for Perl. vMA allows administrators to run scripts or agents that interact with ESX/ESXi and vCenter Server systems without havingto authenticate each time. vMA can also collect and store ESX/ESXi and vCenter Server logs for analysis.
· Line Interface Installation and Scripting Guide
· vSphere Datacenter Administration Guide
· Product Documentation
· vSphere Client
· vicfg-syslog
· vilogger
Tags: 
During a VMworld 2010 session about the VCAP test, I asked the VMW employee whether the test lab will be based on 4.0 or 4.1. He said that it will be on 4.0 for the near future until some other major vSphere releases such as 4.5 or 5.0.
Thanks for the comment and the info about the test versioning.